@opensyber/tokenforge 0.1.0

package/dist/server/storage/memory.js

@@ -0,0 +1,107 @@
+/**
+ * In-memory storage for testing and development.
+ * Not suitable for production — data is lost on restart.
+ */
+export class MemoryStorage {
+    sessions = [];
+    events = [];
+    challenges = [];
+    nonces = new Map(); // nonce → expiry timestamp
+    otps = new Map();
+    async getSession(sessionId, deviceId) {
+        return this.sessions.find((s) => s.session_id === sessionId && s.id === deviceId && s.revoked === 0) ?? null;
+    }
+    async createSession(session) {
+        this.sessions.push({ ...session });
+    }
+    async updateTrustScore(deviceId, trustScore) {
+        const s = this.sessions.find((s) => s.id === deviceId);
+        if (s) {
+            s.trust_score = trustScore;
+            s.last_verified_at = new Date().toISOString();
+        }
+    }
+    async revokeSession(deviceId, reason) {
+        const s = this.sessions.find((s) => s.id === deviceId);
+        if (s) {
+            s.revoked = 1;
+            s.revoked_reason = reason;
+        }
+    }
+    async revokeUserSessions(userId) {
+        for (const s of this.sessions) {
+            if (s.user_id === userId && s.revoked === 0) {
+                s.revoked = 1;
+                s.revoked_reason = 'rebind';
+            }
+        }
+    }
+    async listUserSessions(userId, limit) {
+        return this.sessions
+            .filter((s) => s.user_id === userId)
+            .sort((a, b) => b.bound_at.localeCompare(a.bound_at))
+            .slice(0, limit);
+    }
+    async restoreTrust(deviceId, userId) {
+        const s = this.sessions.find((s) => s.id === deviceId && s.user_id === userId);
+        if (s)
+            s.trust_score = 100;
+    }
+    async hasNonce(nonce) {
+        const expiry = this.nonces.get(nonce);
+        if (!expiry)
+            return false;
+        if (Date.now() > expiry) {
+            this.nonces.delete(nonce);
+            return false;
+        }
+        return true;
+    }
+    async storeNonce(nonce, ttlSeconds) {
+        this.nonces.set(nonce, Date.now() + ttlSeconds * 1000);
+    }
+    async logEvent(event) {
+        this.events.push({ ...event, created_at: new Date().toISOString() });
+    }
+    async listEvents(userId, limit, offset) {
+        return this.events
+            .filter((e) => e.userId === userId)
+            .sort((a, b) => b.created_at.localeCompare(a.created_at))
+            .slice(offset, offset + limit);
+    }
+    async createChallenge(challenge) {
+        this.challenges.push({ ...challenge });
+    }
+    async getChallenge(challengeId, userId) {
+        return this.challenges.find((c) => c.id === challengeId && c.userId === userId && c.status === 'pending') ?? null;
+    }
+    async updateChallengeStatus(challengeId, status, completedAt) {
+        const c = this.challenges.find((c) => c.id === challengeId);
+        if (c) {
+            c.status = status;
+            if (completedAt)
+                c.completedAt = completedAt;
+        }
+    }
+    async countRecentChallenges(userId, windowMinutes) {
+        const cutoff = new Date(Date.now() - windowMinutes * 60 * 1000).toISOString();
+        return this.challenges.filter((c) => c.userId === userId && c.createdAt > cutoff).length;
+    }
+    async storeOtp(challengeId, code, ttlSeconds) {
+        this.otps.set(challengeId, { code, expiresAt: Date.now() + ttlSeconds * 1000 });
+    }
+    async getOtp(challengeId) {
+        const entry = this.otps.get(challengeId);
+        if (!entry)
+            return null;
+        if (Date.now() > entry.expiresAt) {
+            this.otps.delete(challengeId);
+            return null;
+        }
+        return entry.code;
+    }
+    async deleteOtp(challengeId) {
+        this.otps.delete(challengeId);
+    }
+}
+//# sourceMappingURL=memory.js.map

package/dist/server/storage/memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../../src/server/storage/memory.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,MAAM,OAAO,aAAa;IACxB,QAAQ,GAAoB,EAAE,CAAC;IAC/B,MAAM,GAA2D,EAAE,CAAC;IACpE,UAAU,GAA4B,EAAE,CAAC;IACjC,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,2BAA2B;IAC/D,IAAI,GAAG,IAAI,GAAG,EAA+C,CAAC;IAEtE,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,QAAgB;QAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAC1E,IAAI,IAAI,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAsB;QACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,QAAgB,EAAE,UAAkB;QACzD,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,EAAE,CAAC;YACN,CAAC,CAAC,WAAW,GAAG,UAAU,CAAC;YAC3B,CAAC,CAAC,gBAAgB,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAChD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,MAAc;QAClD,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,EAAE,CAAC;YACN,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,cAAc,GAAG,MAAM,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,MAAc;QACrC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;gBAC5C,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;gBACd,CAAC,CAAC,cAAc,GAAG,QAAQ,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,KAAa;QAClD,OAAO,IAAI,CAAC,QAAQ;aACjB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC;aACnC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;aACpD,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,MAAc;QACjD,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC;QAC/E,IAAI,CAAC;YAAE,CAAC,CAAC,WAAW,GAAG,GAAG,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,UAAkB;QAChD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAqC;QAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,KAAa,EAAE,MAAc;QAC5D,OAAO,IAAI,CAAC,MAAM;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;aAClC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;aACxD,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAgC;QACpD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,WAAmB,EAAE,MAAc;QACpD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CACzB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,WAAW,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAC7E,IAAI,IAAI,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,WAAmB,EAAE,MAAc,EAAE,WAAoB;QACnF,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC;QAC5D,IAAI,CAAC,EAAE,CAAC;YACN,CAAC,CAAC,MAAM,GAAG,MAAyC,CAAC;YACrD,IAAI,WAAW;gBAAE,CAAC,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,MAAc,EAAE,aAAqB;QAC/D,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,GAAG,MAAM,CACnD,CAAC,MAAM,CAAC;IACX,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,WAAmB,EAAE,IAAY,EAAE,UAAkB;QAClE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,WAAmB;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAChC,CAAC;CACF"}

package/dist/server/totp.d.ts

@@ -0,0 +1,53 @@
+import type { TokenForgeServerOptions } from '../shared/types.js';
+/**
+ * Callback surface for TOTP attempt rate-limiting. Callers plug in a
+ * storage-backed counter (KV, Redis, D1); when absent, lockout is
+ * disabled and the caller MUST enforce rate-limiting elsewhere.
+ *
+ *  - `getFailedAttempts(userId)` returns the number of failed TOTP
+ *    verifications for the user within the current lockout window.
+ *  - `recordFailedAttempt(userId)` atomically increments the counter
+ *    and sets a TTL of `windowSeconds`.
+ *  - `resetFailedAttempts(userId)` clears the counter on a successful
+ *    verification.
+ */
+export interface TotpRateLimiter {
+    getFailedAttempts(userId: string): Promise<number>;
+    recordFailedAttempt(userId: string, windowSeconds: number): Promise<void>;
+    resetFailedAttempts(userId: string): Promise<void>;
+}
+export declare const TOTP_MAX_ATTEMPTS = 5;
+export declare const TOTP_LOCKOUT_WINDOW_SECONDS = 300;
+export declare class TotpLockedOutError extends Error {
+    readonly retryAfterSeconds: number;
+    constructor(retryAfterSeconds: number);
+}
+/**
+ * TOTP verification (RFC 6238) using HMAC-SHA1.
+ * Time step: 30 seconds, window: +/-1 step tolerance.
+ *
+ * Rate-limiting: when `options.rateLimiter` is provided, the user is
+ * locked out for TOTP_LOCKOUT_WINDOW_SECONDS after TOTP_MAX_ATTEMPTS
+ * failures. A TotpLockedOutError is thrown while locked so callers can
+ * return a distinct 429 to the client instead of a generic "invalid
+ * code". A successful verification resets the counter immediately.
+ *
+ * @param code - The 6-digit TOTP code from the user.
+ * @param userId - User whose TOTP secret to look up.
+ * @param options - Server options; must include `getTotpSecret` callback.
+ * @returns True if the code is valid for the current or adjacent time window.
+ * @throws TotpLockedOutError if the user is currently locked out.
+ */
+export declare function verifyTotp(code: string, userId: string, options: TokenForgeServerOptions & {
+    getTotpSecret?: (userId: string) => Promise<string | null>;
+    rateLimiter?: TotpRateLimiter;
+}): Promise<boolean>;
+/**
+ * Generate a TOTP code for a given counter value.
+ * Uses HMAC-SHA1 per RFC 4226, with 6-digit output.
+ * @param secretBase32 - Base32-encoded shared secret.
+ * @param counter - HMAC counter value (typically `floor(time / 30)`).
+ * @returns A 6-digit zero-padded TOTP code.
+ */
+export declare function generateTotp(secretBase32: string, counter: number): Promise<string>;
+//# sourceMappingURL=totp.d.ts.map

package/dist/server/totp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.d.ts","sourceRoot":"","sources":["../../src/server/totp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAElE;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,eAAe;IAC9B,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD;AAED,eAAO,MAAM,iBAAiB,IAAI,CAAC;AACnC,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C,qBAAa,kBAAmB,SAAQ,KAAK;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,MAAM;gBAAzB,iBAAiB,EAAE,MAAM;CAI/C;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,uBAAuB,GAAG;IACjC,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3D,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B,GACA,OAAO,CAAC,OAAO,CAAC,CAgClB;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAqBzF"}

package/dist/server/totp.js

@@ -0,0 +1,114 @@
+export const TOTP_MAX_ATTEMPTS = 5;
+export const TOTP_LOCKOUT_WINDOW_SECONDS = 300; // 5 min — matches the OWASP ASVS V6.2.6 guidance
+export class TotpLockedOutError extends Error {
+    retryAfterSeconds;
+    constructor(retryAfterSeconds) {
+        super(`Too many failed TOTP attempts; locked out for ${retryAfterSeconds}s`);
+        this.retryAfterSeconds = retryAfterSeconds;
+        this.name = 'TotpLockedOutError';
+    }
+}
+/**
+ * TOTP verification (RFC 6238) using HMAC-SHA1.
+ * Time step: 30 seconds, window: +/-1 step tolerance.
+ *
+ * Rate-limiting: when `options.rateLimiter` is provided, the user is
+ * locked out for TOTP_LOCKOUT_WINDOW_SECONDS after TOTP_MAX_ATTEMPTS
+ * failures. A TotpLockedOutError is thrown while locked so callers can
+ * return a distinct 429 to the client instead of a generic "invalid
+ * code". A successful verification resets the counter immediately.
+ *
+ * @param code - The 6-digit TOTP code from the user.
+ * @param userId - User whose TOTP secret to look up.
+ * @param options - Server options; must include `getTotpSecret` callback.
+ * @returns True if the code is valid for the current or adjacent time window.
+ * @throws TotpLockedOutError if the user is currently locked out.
+ */
+export async function verifyTotp(code, userId, options) {
+    if (!options.getTotpSecret)
+        return false;
+    const limiter = options.rateLimiter;
+    if (limiter) {
+        const attempts = await limiter.getFailedAttempts(userId);
+        if (attempts >= TOTP_MAX_ATTEMPTS) {
+            throw new TotpLockedOutError(TOTP_LOCKOUT_WINDOW_SECONDS);
+        }
+    }
+    const secret = await options.getTotpSecret(userId);
+    if (!secret) {
+        if (limiter)
+            await limiter.recordFailedAttempt(userId, TOTP_LOCKOUT_WINDOW_SECONDS);
+        return false;
+    }
+    const now = Math.floor(Date.now() / 1000);
+    const timeStep = 30;
+    // Check current window and ±1 step for clock skew tolerance
+    for (const offset of [-1, 0, 1]) {
+        const counter = Math.floor((now + offset * timeStep) / timeStep);
+        const expected = await generateTotp(secret, counter);
+        if (timingSafeEqual(code, expected)) {
+            if (limiter)
+                await limiter.resetFailedAttempts(userId);
+            return true;
+        }
+    }
+    if (limiter)
+        await limiter.recordFailedAttempt(userId, TOTP_LOCKOUT_WINDOW_SECONDS);
+    return false;
+}
+/**
+ * Generate a TOTP code for a given counter value.
+ * Uses HMAC-SHA1 per RFC 4226, with 6-digit output.
+ * @param secretBase32 - Base32-encoded shared secret.
+ * @param counter - HMAC counter value (typically `floor(time / 30)`).
+ * @returns A 6-digit zero-padded TOTP code.
+ */
+export async function generateTotp(secretBase32, counter) {
+    const keyBytes = base32Decode(secretBase32);
+    const counterBytes = new ArrayBuffer(8);
+    const view = new DataView(counterBytes);
+    view.setBigUint64(0, BigInt(counter));
+    const key = await crypto.subtle.importKey('raw', keyBytes.buffer, { name: 'HMAC', hash: 'SHA-1' }, false, ['sign']);
+    const hmac = await crypto.subtle.sign('HMAC', key, counterBytes);
+    const hmacArray = new Uint8Array(hmac);
+    // Dynamic truncation (RFC 4226 section 5.3)
+    const offset = hmacArray[hmacArray.length - 1] & 0x0f;
+    const binary = ((hmacArray[offset] & 0x7f) << 24) |
+        ((hmacArray[offset + 1] & 0xff) << 16) |
+        ((hmacArray[offset + 2] & 0xff) << 8) |
+        (hmacArray[offset + 3] & 0xff);
+    return (binary % 1000000).toString().padStart(6, '0');
+}
+/** Decode a base32-encoded string (RFC 4648, no padding required) */
+function base32Decode(input) {
+    const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+    const clean = input.replace(/[= ]/g, '').toUpperCase();
+    const bits = [];
+    for (const char of clean) {
+        const val = alphabet.indexOf(char);
+        if (val === -1)
+            continue;
+        for (let i = 4; i >= 0; i--) {
+            bits.push((val >> i) & 1);
+        }
+    }
+    const bytes = new Uint8Array(Math.floor(bits.length / 8));
+    for (let i = 0; i < bytes.length; i++) {
+        let byte = 0;
+        for (let j = 0; j < 8; j++) {
+            byte = (byte << 1) | (bits[i * 8 + j] ?? 0);
+        }
+        bytes[i] = byte;
+    }
+    return bytes;
+}
+/** Constant-time string comparison to prevent timing attacks */
+function timingSafeEqual(a, b) {
+    const maxLen = Math.max(a.length, b.length);
+    let result = a.length ^ b.length; // length mismatch contributes to failure
+    for (let i = 0; i < maxLen; i++) {
+        result |= (a.charCodeAt(i) || 0) ^ (b.charCodeAt(i) || 0);
+    }
+    return result === 0;
+}
+//# sourceMappingURL=totp.js.map

package/dist/server/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","sourceRoot":"","sources":["../../src/server/totp.ts"],"names":[],"mappings":"AAoBA,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AACnC,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC,CAAC,iDAAiD;AAEjG,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACtB;IAArB,YAAqB,iBAAyB;QAC5C,KAAK,CAAC,iDAAiD,iBAAiB,GAAG,CAAC,CAAC;QAD1D,sBAAiB,GAAjB,iBAAiB,CAAQ;QAE5C,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAY,EACZ,MAAc,EACd,OAGC;IAED,IAAI,CAAC,OAAO,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IAEzC,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IACpC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,QAAQ,IAAI,iBAAiB,EAAE,CAAC;YAClC,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;QACpF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,EAAE,CAAC;IAEpB,4DAA4D;IAC5D,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,MAAM,GAAG,QAAQ,CAAC,GAAG,QAAQ,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrD,IAAI,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpC,IAAI,OAAO;gBAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,OAAO;QAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;IACpF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,YAAoB,EAAE,OAAe;IACtE,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAC;IACxC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAEtC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EAAE,QAAQ,CAAC,MAAqB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CACxF,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IAEvC,4CAA4C;IAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC;IACvD,MAAM,MAAM,GACV,CAAC,CAAC,SAAS,CAAC,MAAM,CAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACvC,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,CAAC;IAElC,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,qEAAqE;AACrE,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,QAAQ,GAAG,kCAAkC,CAAC;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvD,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,SAAS;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gEAAgE;AAChE,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,yCAAyC;IAC3E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,MAAM,KAAK,CAAC,CAAC;AACtB,CAAC"}

package/dist/shared/types-internal.d.ts

@@ -0,0 +1,66 @@
+/** Step-up challenge stored in D1 */
+export interface StepUpChallenge {
+    id: string;
+    session_id: string;
+    user_id: string;
+    reason: string;
+    status: 'pending' | 'completed' | 'expired' | 'failed';
+    method: 'totp' | 'email_otp' | 'passkey' | null;
+    created_at: string;
+    expires_at: string;
+    completed_at: string | null;
+}
+/** Device metadata collected during binding */
+export interface DeviceMetadata {
+    userAgent: string;
+    language: string;
+    platform: string;
+    screenResolution: string;
+    timezone: string;
+    colorDepth: number;
+}
+/** Stored device key in IndexedDB */
+export interface StoredDevice {
+    deviceId: string;
+    keyPair: CryptoKeyPair;
+    createdAt: number;
+    sessionId: string;
+}
+/** Binding request sent to server */
+export interface BindRequest {
+    publicKey: JsonWebKey;
+    sessionId: string;
+    metadata: DeviceMetadata;
+}
+/** Binding response from server */
+export interface BindResponse {
+    deviceId: string;
+    expiresAt: string;
+}
+/** Trust score response from server */
+export interface TrustScoreResponse {
+    trustScore: number;
+    isBound: boolean;
+    deviceId: string | null;
+}
+/** Step-up initiation request */
+export interface StepUpInitiateRequest {
+    method: 'totp' | 'email_otp' | 'passkey';
+}
+/** Step-up initiation response */
+export interface StepUpInitiateResponse {
+    challengeId: string;
+    method: string;
+    expiresAt: string;
+}
+/** Step-up completion request */
+export interface StepUpCompleteRequest {
+    challengeId: string;
+    code: string;
+}
+/** Step-up completion response */
+export interface StepUpCompleteResponse {
+    verified: boolean;
+    trustScore: number;
+}
+//# sourceMappingURL=types-internal.d.ts.map

package/dist/shared/types-internal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-internal.d.ts","sourceRoot":"","sources":["../../src/shared/types-internal.ts"],"names":[],"mappings":"AAGA,qCAAqC;AACrC,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;IACvD,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,IAAI,CAAC;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,+CAA+C;AAC/C,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qCAAqC;AACrC,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,aAAa,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qCAAqC;AACrC,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,UAAU,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,mCAAmC;AACnC,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,uCAAuC;AACvC,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,iCAAiC;AACjC,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAAC;CAC1C;AAED,kCAAkC;AAClC,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,iCAAiC;AACjC,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,kCAAkC;AAClC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB"}

package/dist/shared/types-internal.js

@@ -0,0 +1,4 @@
+// ─── TokenForge Internal Types ───
+// Types used by client internals, not part of the public API surface.
+export {};
+//# sourceMappingURL=types-internal.js.map

package/dist/shared/types-internal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-internal.js","sourceRoot":"","sources":["../../src/shared/types-internal.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,sEAAsE"}

package/dist/shared/types.d.ts

@@ -0,0 +1,148 @@
+/** Configuration for the TokenForge client SDK */
+export interface TokenForgeConfig {
+    /** Base URL of the TokenForge-protected API */
+    apiBase: string;
+    /** How to get the current session ID (from your auth provider) */
+    getSessionId: () => string | null;
+    /** Called when server demands step-up authentication */
+    onStepUpRequired?: (reason: string) => void;
+    /** Called when session is revoked by server */
+    onSessionRevoked?: () => void;
+    /** Called on binding success */
+    onDeviceBound?: (deviceId: string) => void;
+    /** Custom header names */
+    headers?: {
+        signature?: string;
+        nonce?: string;
+        timestamp?: string;
+        deviceId?: string;
+    };
+    /** Enable automatic fetch interception (default: true) */
+    autoIntercept?: boolean;
+    /** Paths to skip (no signing needed) */
+    skipPaths?: string[];
+}
+/** Configuration for the TokenForge server middleware */
+export interface TokenForgeServerOptions {
+    storage: TokenForgeStorageRef;
+    trustThresholds: {
+        /** Score >= this: request proceeds (default: 80) */
+        allow: number;
+        /** Score >= this: step-up required (default: 40) */
+        stepUp: number;
+    };
+    /** Session max age in seconds (default: 86400 = 24h) */
+    sessionMaxAge: number;
+    /** Nonce expiry in seconds (default: 60) */
+    nonceExpiry: number;
+    /** Paths that skip TokenForge verification */
+    skipPaths?: string[];
+    /** Paths requiring elevated trust (>90) */
+    sensitiveOps?: string[];
+    /** Called on security events */
+    onSecurityEvent?: (event: SecurityEvent) => Promise<void>;
+    /** Email delivery callback for OTP step-up */
+    sendEmail?: (to: string, otp: string) => Promise<void>;
+    /** Get IP address from request (framework-specific) */
+    getIpAddress?: (req: unknown) => string;
+    /** Get country code from request (framework-specific) */
+    getCountryCode?: (req: unknown) => string;
+    /** Get user agent from request (framework-specific) */
+    getUserAgent?: (req: unknown) => string;
+    /** Retrieve stored WebAuthn public key (SPKI) for passkey verification */
+    getPasskeyPublicKey?: (userId: string, credentialId: string) => Promise<ArrayBuffer | null>;
+    /** Retrieve TOTP shared secret for a user */
+    getTotpSecret?: (userId: string) => Promise<string | null>;
+}
+/**
+ * Storage reference — import from '@opensyber/tokenforge/server/storage'.
+ * This avoids a circular dep between types.ts and the storage interface.
+ */
+export interface TokenForgeStorageRef {
+    getSession(sessionId: string, deviceId: string): Promise<DeviceSession | null>;
+    createSession(session: DeviceSession): Promise<void>;
+    updateTrustScore(deviceId: string, trustScore: number): Promise<void>;
+    revokeSession(deviceId: string, reason: string): Promise<void>;
+    revokeUserSessions(userId: string): Promise<void>;
+    listUserSessions(userId: string, limit: number): Promise<DeviceSession[]>;
+    restoreTrust(deviceId: string, userId: string): Promise<void>;
+    hasNonce(nonce: string): Promise<boolean>;
+    storeNonce(nonce: string, ttlSeconds: number): Promise<void>;
+    logEvent(event: SecurityEvent & {
+        id: string;
+    }): Promise<void>;
+    listEvents(userId: string, limit: number, offset: number): Promise<(SecurityEvent & {
+        id: string;
+        created_at: string;
+    })[]>;
+    createChallenge(challenge: unknown): Promise<void>;
+    getChallenge(challengeId: string, userId: string): Promise<unknown>;
+    updateChallengeStatus(challengeId: string, status: string, completedAt?: string): Promise<void>;
+    countRecentChallenges(userId: string, windowMinutes: number): Promise<number>;
+    storeOtp(challengeId: string, code: string, ttlSeconds: number): Promise<void>;
+    getOtp(challengeId: string): Promise<string | null>;
+    deleteOtp(challengeId: string): Promise<void>;
+}
+/** A security event logged by the middleware */
+export interface SecurityEvent {
+    sessionId: string;
+    userId: string;
+    eventType: SecurityEventType;
+    trustScoreBefore: number;
+    trustScoreAfter: number;
+    ipAddress: string;
+    countryCode: string;
+    userAgent: string;
+    metadata: Record<string, unknown>;
+}
+/** All possible security event types */
+export type SecurityEventType = 'DEVICE_BOUND' | 'SIGNATURE_INVALID' | 'IP_CHANGE' | 'GEO_ANOMALY' | 'TRUST_DROP' | 'TRUST_SCORE_CHANGE' | 'SESSION_REVOKED' | 'SESSION_EXPIRED' | 'STEP_UP_TRIGGERED' | 'STEP_UP_COMPLETED' | 'STEP_UP_FAILED' | 'NONCE_REPLAY' | 'DEVICE_MISMATCH' | 'DEVICE_NOT_FOUND' | 'TIMESTAMP_SKEW';
+/** Signals used by the trust score engine */
+export interface TrustSignals {
+    signatureValid: boolean;
+    ipAddress: string;
+    originalIp: string;
+    countryCode: string;
+    originalCountry: string;
+    userAgent: string;
+    originalFingerprint: string;
+    requestTimestamp: number;
+    sessionCreatedAt: number;
+}
+/** Breakdown of trust score components */
+export interface ScoreBreakdown {
+    signatureScore: number;
+    ipScore: number;
+    geoScore: number;
+    fingerprintScore: number;
+    velocityScore: number;
+    timeScore: number;
+    nonceScore: number;
+    total: number;
+    reasons: string[];
+}
+/** Device session stored in D1 */
+export interface DeviceSession {
+    id: string;
+    session_id: string;
+    user_id: string;
+    public_key: string;
+    device_fingerprint: string | null;
+    ip_address: string | null;
+    country_code: string | null;
+    trust_score: number;
+    bound_at: string;
+    last_verified_at: string;
+    expires_at: string;
+    revoked: number;
+    revoked_reason: string | null;
+    created_at: string;
+}
+/** Default header names */
+export declare const TF_HEADERS: {
+    readonly SIGNATURE: "X-TF-Signature";
+    readonly NONCE: "X-TF-Nonce";
+    readonly TIMESTAMP: "X-TF-Timestamp";
+    readonly DEVICE_ID: "X-TF-Device-ID";
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/shared/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/shared/types.ts"],"names":[],"mappings":"AAEA,kDAAkD;AAClD,MAAM,WAAW,gBAAgB;IAC/B,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,YAAY,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAClC,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,+CAA+C;IAC/C,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B,gCAAgC;IAChC,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,0BAA0B;IAC1B,OAAO,CAAC,EAAE;QACR,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,0DAA0D;IAC1D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,yDAAyD;AACzD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,eAAe,EAAE;QACf,oDAAoD;QACpD,KAAK,EAAE,MAAM,CAAC;QACd,oDAAoD;QACpD,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,wDAAwD;IACxD,aAAa,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,2CAA2C;IAC3C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gCAAgC;IAChC,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,8CAA8C;IAC9C,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,uDAAuD;IACvD,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IACxC,yDAAyD;IACzD,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IAC1C,uDAAuD;IACvD,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IACxC,0EAA0E;IAC1E,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC5F,6CAA6C;IAC7C,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC5D;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC/E,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1E,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,aAAa,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAC,CAAC;IAC3H,eAAe,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChG,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9E,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpD,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,gDAAgD;AAChD,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,iBAAiB,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,wCAAwC;AACxC,MAAM,MAAM,iBAAiB,GACzB,cAAc,GACd,mBAAmB,GACnB,WAAW,GACX,aAAa,GACb,YAAY,GACZ,oBAAoB,GACpB,iBAAiB,GACjB,iBAAiB,GACjB,mBAAmB,GACnB,mBAAmB,GACnB,gBAAgB,GAChB,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,CAAC;AAErB,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,kCAAkC;AAClC,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,2BAA2B;AAC3B,eAAO,MAAM,UAAU;;;;;CAKb,CAAC"}

package/dist/shared/types.js

@@ -0,0 +1,9 @@
+// ─── TokenForge Shared Types ───
+/** Default header names */
+export const TF_HEADERS = {
+    SIGNATURE: 'X-TF-Signature',
+    NONCE: 'X-TF-Nonce',
+    TIMESTAMP: 'X-TF-Timestamp',
+    DEVICE_ID: 'X-TF-Device-ID',
+};
+//# sourceMappingURL=types.js.map

package/dist/shared/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/shared/types.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAgKlC,2BAA2B;AAC3B,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,SAAS,EAAE,gBAAgB;IAC3B,KAAK,EAAE,YAAY;IACnB,SAAS,EAAE,gBAAgB;IAC3B,SAAS,EAAE,gBAAgB;CACnB,CAAC"}